When a company discovers ransomware, the encryption is usually the last step. Before that, the attackers often spent hours or days inside the network: finding the important systems, stealing data, and switching off backups and security tools.
That gap is your chance. Here are nine signals that often appear before the encryption starts.
Getting in
1. Unusual logins on internet-facing systems. Bursts of failed logins on VPN, remote desktop or email, followed by one success. Or a login from a country where nobody in your company works.
2. A known-exploited vulnerability on an edge device. Many ransomware attacks start through an unpatched VPN gateway, firewall or file-transfer tool. If you have one, assume it is being scanned.
3. A user who suddenly logs in at night. Especially an account with admin rights, or an old account of someone who has left.
Spreading and preparing
4. New admin accounts or added privileges. Attackers create their own accounts or add stolen ones to administrator groups.
5. Remote-access and scanning tools that nobody installed. Legitimate remote-management tools, network scanners or credential-dumping tools appearing on servers.
6. Security tools switched off. Antivirus or EDR disabled, tamper-protection alerts, or logging that suddenly stops.
7. Backups deleted or disabled. Deleted shadow copies, failed backup jobs, or someone logging in to the backup system who normally never does.
Just before impact
8. Large outbound data transfers. Many groups steal data before encrypting it, so they can threaten to publish it (“double extortion”). Watch for unusual uploads to cloud storage or unknown servers, often at night.
9. Mass file renames. Hundreds of files changing name or extension within minutes is one of the last warning signs. By then, every minute counts.
What to do in the first hour
- Isolate, don’t switch off. Disconnect affected systems from the network, but leave them running if possible: memory can contain evidence.
- Protect your backups. Disconnect them and check they are intact.
- Reset the most important passwords from a clean device, starting with admin and remote-access accounts.
- Call for help. Your IT partner, your cyber insurer’s hotline, and an incident-response company if needed. Report the incident to the police. In the Netherlands, check whether you need to report to your regulator under the Cyber Security Act, and to the Dutch Data Protection Authority if personal data is involved.
- Keep a log of what you see and do, with times.
- Don’t pay before getting advice. Check No More Ransom first: for some ransomware families free decryption tools exist.
How OZAG Security helps
OZAG Security watches for these signals around the clock and links them into one incident, with the timeline, the affected systems and the techniques used. A detection such as “mass file rename behaviour” on a server is scored critical, and you get an alert straight away. Try it free for 14 days.